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WE CLAIM: 

1 . A computer program product for controlling a computer to scan computer files 
5 for malware, said computer program product comprising: 

malware scanning code operable to malware scan all computer files stored 
within a storage location as addressed by an operating system to identify any 
computer files stored within said storage location that contain malware; 

identification code operable if no computer files containing malware are found 
10 in said storage location, to identify said storage location as a clean storage location; 
and 

when subsequently reading a computer file, determination code operable to 
determine whether or not said computer file is stored within a clean storage location 
and: 

15 if said computer file is stored within a clean storage location, then permitting 

reading of said computer file without further malware scanning; and 

if said computer file is not stored within a clean storage location, then malware 
scanning said computer file. 

20 2. A computer program product as claimed in claim 1, wherein said malware 

scanning of all computer files stored within a storage location is performed upon a set 
of user specified storage locations from within all storage locations accessible to a 
user. 

25 3. A computer program product as claimed in claim 1, wherein said malware 
scanning of all computer files stored within a storage location is performed as a 
background task. 

4. A computer program product as claimed in claim 3, wherein said malware 
30 scanning of all computer files stored within a storage location as a background task is 
performed with more thorough scanning options selected than for on-access scanning 
applied to computer files not stored within clean storage locations and being accessed 
by a user. 
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5. A computer program product as claimed in claim 1, wherein a computer file is 
malware scanned before being written to a clean storage location. 

6. A computer program product as claimed in claim 1 , wherein said malware 
scanning code uses malware definition data to identify malware and, upon updating of 
said malware definition data to give updated malware definition data, said storage 
location is no longer identified as a clean storage area until it has been malware 
scanned using said updated malware definition data and no computer files containing 
malware are found in said storage location. 

7. A computer program product as claimed in claim 6, wherein, when said 
storage area is being malware scanned with said updated malware definition data, 
computer files written to said storage location after said storage location was 
previously identified as a clean storage location are malware scanned before computer 
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Ul 15 files that are unaltered since said storage location was previously identified as a clean 
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storage location. 



8. A computer program product as claimed in claim 1 , wherein said malware is 
one or more of a computer virus, a worm, a Trojan, a banned computer file, a banned 

20 word and a banned image. 

9. A method of scanning computer files for malware, said method comprising the 
steps of: 

malware scanning all computer files stored within a storage location as 
25 addressed by an operating system to identify any computer files stored within said 
storage location that contain malware; 

if no computer files containing malware are found in said storage location, 
then identifying said storage location as a clean storage location; and 

when subsequently reading a computer file, determining whether or not said 
30 computer file is stored within a clean storage location, whereupon: 

if said computer file is stored within a clean storage location, then permitting 
reading of said computer file without further malware scanning; and 

if said computer file is not stored within a clean storage location, then malware 
scanning said computer file. 
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10. A method as claimed in claim 9, wherein said step of malware scanning all 
computer files stored within a storage location is performed upon a set of user 
specified storage locations from within all storage locations accessible to a user. 

11. A method as claimed in claim 9, wherein said step of malware scanning all 
computer files stored within a storage location is performed as a background task. 

12. A method as claimed in claim 1 1 , wherein said step of malware scanning all 
computer files stored within a storage location as a background task is performed with 
more thorough scanning options selected than for on-access scanning applied to 
computer files not stored within clean storage locations and being accessed by a user. 

13. A method as claimed in claim 9, wherein a computer file is malware scanned 
before being written to a clean storage location. 

14. A method as claimed in claim 9, wherein said malware scanning uses malware 
definition data to identify malware and, upon updating of said malware definition data 
to give updated malware definition data, said storage location is no longer identified 
as a clean storage area until it has been malware scanned using said updated malware 
definition data and no computer files containing malware are found in said storage 
location. 

15. A method as claimed in claim 14, wherein, when said storage area is being 
malware scanned with said updated malware definition data, computer files written to 
said storage location after said storage location was previously identified as a clean 
storage location are malware scanned before computer files that are unaltered since 
said storage location was previously identified as a clean storage location. 

1 6. A method as claimed in claim 9, wherein said malware is one or more of a 
computer virus, a worm, a Trojan, a banned computer file, a banned word and a 
banned image. 
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1 7. Apparatus for scanning computer files for malware, said apparatus 
comprising: 

malware scanning logic operable to malware scan all computer files stored 
within a storage location as addressed by an operating system to identify any 
5 computer files stored within said storage location that contain malware; 

identification logic operable if no computer files containing malware are found 
in said storage location, to identify said storage location as a clean storage location; 
and 

when subsequently reading a computer file, determination logic operable to 
10 determine whether or not said computer file is stored within a clean storage location 
and: 

if said computer file is stored within a clean storage location, then permitting 
q reading of said computer file without further malware scanning; and 
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n\ if said computer file is not stored within a clean storage location, then malware 
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18. A computer program product as claimed in claim 1 7, wherein said malware 
H scanning of all computer files stored within a storage location is performed upon a set 
py of user specified storage locations from within all storage locations accessible to a 
•;g0 user. 

19. A computer program product as claimed in claim 17, wherein said malware 
scanning of all computer files stored within a storage location is performed as a 
background task. 

25 

20. A computer program product as claimed in claim 19, wherein said malware 
scanning of all computer files stored within a storage location as a background task is 
performed with more thorough scanning options selected than for on-access scanning 
applied to computer files not stored within clean storage locations and being accessed 

30 by a user. 

21. A computer program product as claimed in claim 1 7, wherein a computer file 
is malware scanned before being written to a clean storage location. 
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22. A computer program product as claimed in claim 17, wherein said malware 
scanning logic uses malware definition data to identify malware and, upon updating of 
said malware definition data to give updated malware definition data, said storage 
location is no longer identified as a clean storage area until it has been malware 

5 scanned using said updated malware definition data and no computer files containing 
malware are found in said storage location. 

23. A computer program product as claimed in claim 22, wherein, when said 
storage area is being malware scanned with said updated malware definition data, 

10 computer files written to said storage location after said storage location was 

previously identified as a clean storage location are malware scanned before computer 
files that are unaltered since said storage location was previously identified as a clean 
7*1 storage location. 

fjjs 24. Apparatus as claimed in claim 17, wherein said malware is one or more of a 

computer virus, a worm, a Trojan, a banned computer file, a banned word and a 
* banned image. 

ri I 

i hi 
\~z \ 



17 



